gitlab: disable macOS jobs in forks

The GitLab macOS runners are only available in Premium and Ultimate
tier projects. This permits their use in QEMU upstream via the OSS
Program membership perk, but this does not extend to forks of QEMU.
The macOS jobs thus need to be disabled in forks, otherwise all
pipelines will immediately report a failure due to inability to
access a runner.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20260610091700.2772973-1-berrange@redhat.com
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

.gitlab-ci.d/base.yml

@@ -52,6 +52,11 @@ variables:
     - if: '$CI_PIPELINE_SOURCE == "schedule"'
       when: never
 
+    # macOS jobs can't run in forks until gitlab opens up runner availability
+    # to all tiers https://gitlab.com/groups/gitlab-org/-/work_items/8267
+    - if: '$QEMU_JOB_MACOS == "1" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+      when: never
+
     # Publishing jobs should only run on the default branch in upstream
     - if: '$QEMU_JOB_PUBLISH == "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never

.gitlab-ci.d/macos.yml

@@ -36,6 +36,7 @@ aarch64-macos-15-build:
   extends: .macos_job_template
   image: macos-15-xcode-16
   variables:
+    QEMU_JOB_MACOS: 1
     NAME: macos-15
     PATH_EXTRA: /opt/homebrew/gettext/bin
     PKG_CONFIG_PATH: /opt/homebrew/curl/lib/pkgconfig:/opt/homebrew/ncurses/lib/pkgconfig:/opt/homebrew/readline/lib/pkgconfig
@@ -52,6 +53,7 @@ aarch64-macos-26-build:
   extends: .macos_job_template
   image: macos-26-xcode-26
   variables:
+    QEMU_JOB_MACOS: 1
     NAME: macos-26
     DYLD_LIBRARY_PATH: /opt/homebrew/opt/expat/lib/
     PATH_EXTRA: /opt/homebrew/gettext/bin

docs/devel/testing/ci-jobs.rst.inc

@@ -125,6 +125,13 @@ QEMU_JOB_FUNCTIONAL
 
 The job runs the functional test suite
 
+QEMU_JOB_MACOS
+~~~~~~~~~~~~~~
+
+The job requires access to the macOS shared runners, which are
+only available to Premium/Ultimate tiers. This includes OSS project
+members, but not forks.
+
 Contributor controlled runtime variables
 ----------------------------------------